Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-109949 →

DEBIAN-CVE-2026-109949

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN retry counter per-handle. A malicious RDP server can exhaust the counter with VERIFY APDUs, then request a new SCardConnect to reset attempts, enabling unbounded online brute-forcing of the configured smartcard PIN.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 freerdp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-1"}]}]

Références

advisory security-tracker.debian.org